I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature.

The content keyword search in the payload of the packet, I need to search on the header information of the packet but I couldn't find it.

Once I have this signature I will adjust to not match so I can be able to detect unencrypted traffic.

Can anyone can help on that?

  • This is difficult to read. What do you want to find in the header? – schroeder Jan 20 at 16:57
  • Have you read the official documentation? snort.org/faq/readme-ssl It describes what to look for. – schroeder Jan 20 at 17:00
  • 3
    I guess something like stream_size:client,=,0; content: "|16 03 03|" should be able to detect the start of a TLS 1.2 and TLS 1.3 ClientHello. And similar matches with |16 03 02| for TLS 1.1. and |16 03 01| for TLS 1.0. – Steffen Ullrich Jan 20 at 17:08
  • You can use also for user data | 17 03 01 | for tls 1.0 and | 17 03 03 | and for alarms 15 on the first byte and 14 for cipher exchanges I think – camp0 Jan 20 at 17:23
  • @Schroeder any keywords that can match the tls nothing specific – rekoo Jan 20 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.